this post was submitted on 27 May 2024
31 points (87.8% liked)

Selfhosted

39996 readers
841 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

  1. Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.

  2. No spam posting.

  3. Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.

  4. Don't duplicate the full text of your blog or github here. Just post the link for folks to click.

  5. Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).

  6. No trolling.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 1 year ago
MODERATORS
ruud
Loki
CannaVet
devve
HybridSarcasm
[email protected]
31
Is it safe to open a forgejo git ssh port in my router? (self.selfhosted)
submitted 5 months ago* (last edited 5 months ago) by gurapoku to c/selfhosted
29 comments fedilink hide all child comments
 

Hello all! Yesterday I started hosting forgejo, and in order to clone repos outside my home network through ssh://, I seem to need to open a port for it in my router. Is that safe to do? I can't use a vpn because I am sharing this with a friend. Here's a sample docker compose file:

version: "3"

networks:
  forgejo:
    external: false

services:
  server:
    image: codeberg.org/forgejo/forgejo:7
    container_name: forgejo
    environment:
      - USER_UID=1000
      - USER_GID=1000
      - FORGEJO__database__DB_TYPE=postgres
      - FORGEJO__database__HOST=db:5432
      - FORGEJO__database__NAME=forgejo
      - FORGEJO__database__USER=forgejo
      - FORGEJO__database__PASSWD=forgejo
    restart: always
    networks:
      - forgejo
    volumes:
      - ./forgejo:/data
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
    ports:
      - "3000:3000"
      - "222:22" # <- port 222 is the one I'd open, in this case
    depends_on:
      - db

  db:
    image: postgres:14
    restart: always
    environment:
      - POSTGRES_USER=forgejo
      - POSTGRES_PASSWORD=forgejo
      - POSTGRES_DB=forgejo
    networks:
      - forgejo
    volumes:
      - ./postgres:/var/lib/postgresql/data

And to clone I'd do

git clone ssh://git@<my router ip>:<the port I opened, in this case 222>/path/to/repo

Is that safe?

EDIT: Thank you for your answers. I have come to the conclusion that, regardless of whether it is safe, it doesn't make sense to increase the attack surface when I can just use https and tokens, so that's what I am going to do.

all 31 comments
sorted by: hot top controversial new old
[–] [email protected] 14 points 5 months ago (2 children)

Opening ports on your router is never safe ! There're alot of bots trying to bruteforce opening ports on the web (specially ssh port 22)

With SSH I would disable the password authentication a only used key based authentication. Also disable root access. (Don't know how it works with forgero though)

I would recommend something like wireguard, you still need to open a port on your router, but as long as they don't have your private key, they can't bruteforce it. (You can even share the wireguard tunnel with your friend :))

Also use a reverse proxy with your docker containers.

There are a lot of things you could do to secure everything, but If you relatively new to selfhosting, there's a steep learning curve and a lot of time needed to properly secure everthing up. You could be safe by doing nothing for a few months but as soon as someone got into your system, you're fucked !

But don't discourage yourself, selfhosting is fun !

[–] [email protected] 21 points 5 months ago (1 children)

Opening ports on your router is never safe !

This is both true and highly misleading. Paranoia isn't a replacement for good security.

I would recommend something like wireguard, you still need to open a port on your router, but as long as they don't have your private key, they can't bruteforce it.

The same is true of ssh when using keys to authenticate.

[–] [email protected] 1 points 5 months ago (1 children)

You're right, but only if you are an experienced IT guy in enteprise environnement. Most users (myself included) on Lemmy do not have the necessary skills/hardware to properly configure and protect their networking system, thats way I consider something like wireguard way more secure than opening an SSH port.

Sure SSH key based configuration is also doing a great job but there is way more error prone configuration with an SSH connection than a wireguard tunnel.

[–] [email protected] 4 points 5 months ago

You’re right, but only if you are an experienced IT guy in enteprise environnement. Most users (myself included) on Lemmy do not have the necessary skills/hardware to properly configure and protect their networking system, thats way I consider something like wireguard way more secure than opening an SSH port.

But it doesn't help to just tell newbs that "THAT'S INSECURE" without providing context. It 1) reinforces the idea that security "is a thing" rather than "something you do" and 2) doesn't give them any further reference for learning.

It's why some people in this community think that putting a nginx proxy in front of their webapp somehow increases their security posture. Because you don't have "direct access" to the webapp. It's ridiculous.

Sure SSH key based configuration is also doing a great job but there is way more error prone configuration with an SSH connection than a wireguard tunnel.

In this case it's handled by forgejo.

[–] gurapoku 4 points 5 months ago* (last edited 5 months ago)

The reason why I am asking this question is because I think that the ssh port I am opening only has access to my repos (which means that even if I somehow get hacked the damage is minimal) and it doesn't accept any keys aside from mine and my friend's, which we set up through the web interface :).

I have wireguard setup and I'd also thought about sharing a tunnel with my friend, but it seemed much more hasslesome than simply opening the port, not to mention the fact that if anyone wanted to join too I'd have to do that again.

It is exactly because I am afraid of getting fucked that I am asking this and being careful. For now, my idea is to only open the port when someone is about to use it, since I am not absolutely sure that it won't somehow accept a request from a person with less than noble intentions. (either that, either simply use tokens)

Reverse proxying was also my intention at first, but I just couldn't get it to work with cloudflare for some reason!

Thanks for the insight!

[–] [email protected] 8 points 5 months ago

Just make sure to keep the machine updated.

[–] [email protected] 8 points 5 months ago (1 children)

You can also use p2p mesh vpn services like zerotier or tailscale to establish a direct connection without opening any port in the router at all.

[–] gurapoku 2 points 5 months ago (2 children)

A good suggestion, but it would still be hasslesome to setup. Plus, my friend would have to connect to the vpn whenever he wants to push/pull the repo

[–] [email protected] 3 points 5 months ago* (last edited 5 months ago)

Tailscale has the Funnel feature which doesn't require your friends use the client.

[–] [email protected] 1 points 5 months ago

Yes everyone would need a client (probably?) but after having recently set it up the first time, its incredibly simple.

[–] [email protected] 6 points 5 months ago (1 children)

I have come to the conclusion that, regardless of whether it is safe, it doesn't make sense to increase the attack surface when I can just use https and tokens, so that's what I am going to do.

Are you already exposing HTTPS? Because if not you would still be "increasing your attack surface".

[–] gurapoku 1 points 5 months ago (1 children)

Yes, or else I wouldn't have access to the web interface haha

[–] [email protected] 7 points 5 months ago (1 children)

Wait, so you have the full website exposed to the Internet and you're concerned about enabling ssh access? Because of the two ssh would likely be the more secure.

But either are probably "fine" so long as you have only trusted users using the site.

[–] gurapoku 1 points 5 months ago* (last edited 5 months ago) (1 children)

Yes, hosting the site seems much safer (at least in theory) since I am proxying it through cloudflare and I am planning on putting ngynx too on top of that this afternoon

(And signup is disabled, so hopefully only trusted users can access it)

[–] [email protected] 8 points 5 months ago (1 children)

I am not sure where this idea comes from, but putting a service behind a reverse-proxy does not increase its security in any way, unless you'd do authentication right at the reverse-proxy.

[–] [email protected] 2 points 5 months ago* (last edited 5 months ago) (1 children)

I spent my day today setting up nginx with mtls at work, and I actually think it's a great approach for what op is trying

[–] [email protected] 3 points 5 months ago

Oh, I didn't want to suggest that there is no value in using a reverse-proxy, there certainly is. Just don't expect it to do anything for you in terms of application security. The application behind it is just as exposed as it would be without a proxy. So if there was a security flaw in that application, the reverse-proxy does not help at all.

[–] [email protected] 2 points 5 months ago* (last edited 5 months ago) (1 children)

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I've seen in this thread:

Fewer Letters More Letters
Git Popular version control system, primarily for code
HTTP Hypertext Transfer Protocol, the Web
HTTPS HTTP over SSL
SSH Secure Shell for remote terminal access
SSL Secure Sockets Layer, for transparent encryption
VPN Virtual Private Network
nginx Popular HTTP server

[Thread #764 for this sub, first seen 27th May 2024, 10:05] [FAQ] [Full list] [Contact] [Source code]

[–] p5yk0t1km1r4ge 2 points 5 months ago

Yeah do it bro

[–] [email protected] 1 points 5 months ago (1 children)

Yes, as safe as SSH can be. Why not use https with cloudfare tunnels? For SSH, depends on security config and ofuscation measures... Like disabling root login, use encryption keys instead of plain password, pick a "hidden" port number, and so on. There were many posts here and all over the web about this. I would add either crowdsec or fail2ban to the mix.. That's prettt much all that there is.

[–] gurapoku 3 points 5 months ago* (last edited 5 months ago) (2 children)

I am still very much a noob to self-hosting, but I am not the one managing this ssh port, forgero is. Is there not any difference between the two? I think you can only access the forgejo ssh if you have a matching private key for one of the user's public keys...

(And although it surprised me too, I couldn't find information about the safety of specifically this online)

[–] [email protected] 4 points 5 months ago (1 children)

Git works fine over https though, no need to increase the attack surface by enabling SSH access in Forgejo.

[–] gurapoku 2 points 5 months ago

That's also a possibility, yes. Probably what I should do, taking the rest of the answers into account

[–] [email protected] 3 points 5 months ago

There's a lot of wrong advice about this subject on this post. Forgejo, and any other Git forge server, have a completely different security model than regular SSH. All authenticated users run with the same PID and are restricted to accessing Git commands. It uses the secure shell protocol but it is not a shell. The threat model is different. Anybody can sign up for a GitHub or Codeberg account and they will be granted SSH access, but that access only allows them to push and pull Git data according to their account permissions.

[–] [email protected] 1 points 5 months ago* (last edited 5 months ago)

As of now all advice here is kinda missing the point or wrong... (Exept the one recommendation to do updates ;-) I wouldn't use Cloudflare as it's really bad for freedom, watches your traffic and most interesting things aren't even in the free/cheap plans... You can't restrict connections to the "Established state" or you can't ever connect to your server... And SSH is a safe protocol. Just depends on the strength of your passwords... And yeah, opening ports is never 100% safe. Neither is using computers. They can be hacked but that's not helping... And I'd agree using Wireguard or Tailscale would help. But you already said you don't want a VPN...

I didn't have a proper look at the Forgejo Docker container. I'd say it's safe. It's probably using keys instead of passwords(?!) I hope they configured it properly if they ship it per default. And it's running sandboxed in your Docker container anyways and not running a system shell on the machine.

The issue with SSH is, there are lots of bots scanning the internet for SSH servers and testing passwords all day. Your server will be subject to a constant stream of brute-forcing attempts. Unless you take some precautions. Usually that's done by blocking attackers after some amount of failed login attempts. This is either preconfigured in your Docker container (you should check, or watch the logs.) Or you'd need to use something like fail2ban on top. Or ignore the additional load and have all your users use good passwords.

(What I do is use Git over https. That worked out of the box while ssh would have required additional work. But I also have lots of other ports forwarded to several services on my home-server. Including ssh. No VPN, no Cloudflare ... I have fail2ban and safe passwords. I'm happy with that.)

[–] [email protected] 0 points 5 months ago* (last edited 5 months ago) (1 children)

If your forgejo host needs to connect to the outside world, you can open the port for incomming traffic only for related and established traffic. That way when somebody wants to connect to your port as a new connection it will fail. So when somebody has bad intentions, it will not work unless you've already connected to them in the first place. You need to permit outgoing traffic from forgejo if you block outgoing traffic.

[–] gurapoku 1 points 5 months ago (1 children)

I see, only allowing established traffic to connect sounds like something that could work. But I don't know how I can do this, do you have some pointers :)?

Blocking outgoing traffic and having to whitelist forgejo seems a bit extreme though

[–] [email protected] 2 points 5 months ago (1 children)

Blocking outgoing traffic isn't needed. But was mere a headsup if that is something you've alread setup. What router do you have? Usually when you open a port there is a dropdown menu or checkboxes for what kind of connection the port opening is allowed.

[–] gurapoku 1 points 5 months ago

I'd rather not say which router I have since it would reveal quite a bit of information about me. However, I do know that the connections that my router allows are tcp and udp